<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/2/17 8:33 PM, Paul B. Henson
wrote:
<pre wrap="">
</pre>
</div>
<blockquote type="cite"
cite="mid:20170603003346.GE3388@bender.cpp.edu">
<pre wrap="">
<decision-state id="ShouldUnsetCookie">
<on-entry>
<evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp').debug('entering expiring-password-flow ShouldUnsetCookie')" />
<if test="ExpiringPasswordCookieManager.getCookieValue(ExpiringPasswordCookieName, null) != null"
then="UnsetCookie" else="proceed" />
</decision-state></pre>
</blockquote>
<br>
May or may not be significant, but unless it's a cut/paste error,
you're missing the closing </on-entry> tag there. That would
make it not even well-formed XML, and I would think SWF would scream
about that. (Per below, that would also sort of imply this isn't
running)<br>
<br>
<blockquote type="cite"
cite="mid:20170603003346.GE3388@bender.cpp.edu">
<pre wrap="">
However, after authenticating, none of these log messages show up:
# grep expiring-password-flow /opt/shibboleth-idp/logs/idp-process.log
2017-06-02 17:13:01,378 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'intercept/expiring-password' using 'file [/opt/shibboleth-idp/flows/../system/flows/intercept/expiring-password-flow.xml]'
2017-06-02 17:13:01,386 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'authn/conditions/expiring-password' using 'file [/opt/shibboleth-idp/flows/authn/conditions/expiring-password/expiring-password-flow.xml]'
</pre>
</blockquote>
<br>
That certainly implies that that flow isn't even running.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:20170603003346.GE3388@bender.cpp.edu">
<pre wrap="">
Also, there are only two cookies from the idp in my browser:
JSESSIONID
shib_idp_session
The shib_idp_exp_pwd cookie doesn't seem to be getting set 8-/.</pre>
</blockquote>
<br>
That also implies that the flow isn't running. <br>
<br>
<br>
<blockquote type="cite"
cite="mid:20170603003346.GE3388@bender.cpp.edu">
<pre wrap="">
I've disabled some of the other things that use intercepts, such as user-level
attribute consent. Would that somehow cause the password expiration intercept
not to run?</pre>
</blockquote>
<br>
Well, it doesn't run automatically. You have to explicitly enable
it on the profile config. So you'd need something like this on the
relevant profile config (here for SAML 2 SSO):<br>
<br>
<tt><br>
</tt><tt><bean parent="SAML2.SSO"
p:postAuthenticationFlows="#{{'expiring-password'}}" /></tt><br>
<br>
<br>
It has to be on the one that is effective for the SP in question, so
if you relying party overrides, you need to factor that in.
Obviously if you're also doing attribute consent or terms of use,
etc, those would also appear in the list.<br>
<br>
Documentation refs:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ProfileInterceptConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/ProfileInterceptConfiguration</a><br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ExpiringPasswordInterceptConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/ExpiringPasswordInterceptConfiguration</a><br>
<br>
<br>
<br>
<br>
<code class="xml plain"></code>
</body>
</html>